Hi All

 

I have my script below which displays info from the id variable, if the id is invalid ie someone puts '()":' in the address bar I want to show my error message, but at the moment I get:

 

You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '' at line 1

 

or if someone puts in id eg 123456 it displays the page with no information in?

 

Hope that makes sense?

 

Thanks Ben

 

 

<?php 
$page_title = 'viewlatest'; 
	require_once (../../../mysql_connect.php'); // Connect to the db. 


error_reporting (E_ALL);

$id = mysql_real_escape_string($_GET['id']); //user id



  /// selected from db 
  $query = "SELECT * FROM users WHERE user_id=$id";
  $result = @mysql_query ($query) or die (mysql_error());
  $myrow = mysql_fetch_array($result, MYSQL_ASSOC);

if ($id) {	 


$imagesize='height="170" width="500"';
$imagesizeuploaded='height="170" width="500"';
$alignright='right';
$class='mainimage';


  echo '<h3>' . $myrow['name'] . '</h3>'; 
  echo '<h4><img ' . $imagesize .' src="uploads/'.$myrow['file1'] .'" class="'.$class .'"/></h4>';

  echo '<h4>' . $myrow['area'] . '</h4>';
  echo '<h4>' . $myrow['subdescript'] . '</h4>';

  if(!empty($myrow['linksite'])){
		  echo '<p><a href="' . $myrow['linksite'] . '" target="_blank">link to website</a>';


//start of gallery check 

$name2 = $myrow['user_id'];

$query = "SELECT * FROM `gallery` WHERE `user` = '$name2'"; 
$result = @mysql_query ($query) or die (mysql_error());
$myrow = mysql_fetch_array($result, MYSQL_ASSOC);

if(($myrow['user']) == $name2){
			echo' | <a href="gallery.php?name=' . rawurlencode(stripcslashes($myrow['user'])) . '">View picture gallery</a></p>';


$query = "SELECT * FROM users WHERE user_id=$id";
$result = @mysql_query ($query) or die (mysql_error());
$myrow = mysql_fetch_array($result, MYSQL_ASSOC);

echo '<p>' . $myrow['descript'] . '</p>';


echo '<p><a href="#top">Back to Top</a></p>';

			} else {

			echo '';//gallery empty


$query = "SELECT * FROM users WHERE user_id=$id";
$result = @mysql_query ($query) or die (mysql_error());
$myrow = mysql_fetch_array($result, MYSQL_ASSOC);


			echo '<p>' . $myrow['descript'] . '</p>';

			echo '<p><a href="#top">Back to Top</a></p>';	

}

//end of gallery check 		  


//if link empty

 } else {

//start of gallery check 

$name2 = $myrow['user_id'];

$query = "SELECT * FROM `gallery` WHERE `user` = '$name2'"; 
$result = @mysql_query ($query) or die (mysql_error());
$myrow = mysql_fetch_array($result, MYSQL_ASSOC);

if(($myrow['user']) == $name2){
			echo'<p><a href="gallery.php?name=' . rawurlencode(stripcslashes($myrow['user'])) . '">View picture gallery</a></p>';


$query = "SELECT * FROM users WHERE user_id=$id";
$result = @mysql_query ($query) or die (mysql_error());
$myrow = mysql_fetch_array($result, MYSQL_ASSOC);

echo '<p>' . $myrow['descript'] . '</p>';


echo '<p><a href="#top">Back to Top</a></p>';

			} else {

			echo ''; //gallery empty


$query = "SELECT * FROM users WHERE user_id=$id";
$result = @mysql_query ($query) or die (mysql_error());
$myrow = mysql_fetch_array($result, MYSQL_ASSOC);


			echo '<p>' . $myrow['descript'] . '</p>';

			echo '<p><a href="#top">Back to Top</a></p>';	

}

//end of gallery check 	

   }






}  
else { /// if db not run display error 
echo '<table align="center" cellspacing="0" cellpadding="5">';
echo'<td><span class = "style1">Sorry, no records found!</span></td>';
echo '</table>'; 
} 

?>

Instead of this if statement:

if ($id) {

 

Try:

if (mysql_num_rows($result) > 0) {

 

Then you're only rendering the page if there's a result..

Thanks Tucker should have known that, doh! Welcome to the forum!

Over the years, I've learned a few tricks, and one of them is to wrap these checks into functions. It means you can call them at the head of each page (before output of any headers) to ascertain a redirect before the rest of the page is parsed, should the 'id' field not correlate to any records.

 

For instance... why not build the ID check into the SQL connect script? That way, it's reusable, and the page only continues loading and parsing if that stage is reached. For security purposes, this is a good idea, plus it's also 'neat and tidy'. Also, it means you can have a generic 'Hang on, something went wrong' page, rather than relying on errors being generated in-page. Just a thought.

 

Another minor note... never use the variable ID in a $_GET or $_POST... it can cause unwelcome problems as it's a 'common' name which people can misuse as a backdoor.

 

Try and use 'visitor_id' or something more descriptive.

Thanks Siege, Im quite new to php so how would I build the id check into SQL connect script?

 

Nice tip for id aswell!

 

PS Nice magic site, just reading Derren Brown at the mo!

Thanks Siege, Im quite new to php so how would I build the id check into SQL connect script?

 

When using require/include, any variables in the calling page/script are inherited by the include. Therefore, here's how I'd do it...

 

1. In the include php file which connects to the database, include a check, much like the following...

 

if (isset($validate))  // does the variable $validate exist? 
{
  $query = "SELECT * FROM users WHERE user_id=$id";
  $result = @mysql_query ($query) or die (mysql_error());
  $myrow = mysql_fetch_array($result, MYSQL_ASSOC);

if (mysql_num_rows($result) <=0) {
header("location:http://server.com/errorpage.php"); // redirect to error page, skipping the rest of the original page
}
// nothing else to check, so the include file finishes and the rest of the original page continues parsing
}

 

2. At the start of the page requiring ID checking... BEFORE the call to the include page (the DB connect)...

 

$validate = 'yes'; // validation mode 'on'... by including this variable and giving it a value, the DB connect script also checks for a valid $id

 

Using this method, the chunks of code needed to do the check can be accessed and checked on any page just by setting the variable '$validate' before calling the DB connect script.

 

Furthermore, because the scope of the variables used are local to the page, the values generated in the '$myrow' array are accessible to the page without having to duplicate code.

 

Re-using code like this can be a fantastic way to keep pages clean, and also save on a lot of work!

 

Incidentally, this is a *simple* method to achieve this result. There's other ways, as I am sure you will discover, which are in some ways neater, but if you're new to PHP, the method I describe above should make sense, and by looking 'which bit does what' it should teach you a bit about nesting includes and how they are useful.